In various technologies for enhancing computer security, a virtual machine introspection (VMI) technology can be preferably used to perform security protection on a virtual machine (VM). A VMI system may run in a virtual machine monitor (VMM), and the VMM may enhance security performance of a VM from the exterior of the VM by using the VMI system, so as to implement protection on the VM. Further, the VMM may monitor an internal running status of the VM outside the VM by using the VMI system, for example, the VMI system may directly scan a memory and a magnetic disk of the VM, monitor a network behavior, and the like to perform security check on the VM. After the VMI technology is used, because the VMI system runs outside the VM, the running of the VMI system cannot be interfered with even if the VM has been infected by malware.
Specific security detection steps may include: the VMI system may acquire to-be-checked in-memory data from the VM; and perform security check on the acquired to-be-checked in-memory data.
However, when the VMI system performs security check on the in-memory data in the VM, the VM may also be accessing the to-be-checked in-memory data. In this case, the VM modifies, after the VMI system acquires a part of the to-be-checked in-memory data, local in-memory data corresponding to the part of the to-be-checked in-memory data, resulting in that the in-memory data acquired by the VMI system is inconsistent with the local in-memory data in the VM, and further resulting in that the VMI system cannot accurately perform security check on the in-memory data in the VM.